Once you acquire the memory of an infected system, the next step is to analyze the acquired memory image. Volatility (http://www.volatilityfoundation.org/releases) is an open source advanced memory forensics framework written in Python that allows you to analyze and extract digital artifacts from the memory image. Volatility can run on various platforms (Windows, macOS, and Linux), and it supports analysis of memory from 32-bit and 64-bit versions of Windows, macOS, and Linux operating systems.
3. Volatility Overview
Get Learning Malware Analysis now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
